Add CAPTCHA for registration (and password reset?) - Githubissues

dboehmer / coocook

👨‍🍳🦉 Web application for collecting recipes and making food plans

https://coocook.org/

Other

11 stars 2 forks source link

Add CAPTCHA for registration (and password reset?) #103

Closed dboehmer closed 4 years ago

dboehmer commented 4 years ago

On Coocook.org we have a problem with hundreds of autocreated users.

Free user registration offers a way to spam random people with e-mail. But with Coocook it should be already impossible to control the content of e-mails being sent.

To avoid people receiving unexpected e-mail and to reduce the number of fake accounts we should still implement some kind of CAPTCHA.

My requirements:

not using Google Recaptcha although it's a high quality service
should be as little as possible annoying
avoid dependencies on fat graphics libraries for image rendering

Questions:

How to run unit tests? Just disable CAPTCHA filter in the config? How to test the CAPTCHA itself?
What about text CAPTCHAs? I thought of quiz questions like What is the sum three and five? or What is water below 0°C? (ice)

@moseschmiedel @ChristinaSi @CennoxX @cncpl Any ideas on this?

dboehmer commented 4 years ago

Done with cc9f493. If this won't help enough, reopen or create a new issue later.

Implemented measures:

hidden <input> field luring autofill bots into posting values
storing current timestamp in session when sending form page and requiring the timestamp to exist when posting the form data
minimum and maximum time for filling the form